Dattavani Backend: Request Pipeline (GET /api/kids/home-stats) Diagram

Starlette runs the last-registered middleware first.
So a request passes the New Relic gate (main.py:343), then RequestContextMiddleware (main.py:307), then CORSMiddleware (main.py:282), then routing.
RequestContextMiddleware never rejects a request. It binds request_id and, when it can, parent_id for logs and New Relic.
CORSMiddleware adds CORS headers only when the request sends an Origin header; the mobile app usually does not.

There is no global auth check. Each route declares a dependency.
Kid routes verify the Kid Profile JWT locally, then run queries as the parent: the parent's token comes from device_sessions and is refreshed through Supabase Auth when expired.
Parent routes use get_current_user: local decode of the Supabase JWT (HS256 secret or JWKS), falling back to Supabase /auth/v1/user.

Routes with response_model=ApiResponse, and paths under /api/chat, /api/conversations, /api/tataji, /api/feedback, /api/avatar-session and /api/swamiji, always return {success, message, data, code}.
Other routes return FastAPI's {detail} on errors.
Codes live in constants/response_codes.py: 1001 TOKEN_EXPIRED, 1003 NO_DATA, 1005 AUTH_ERROR, 1006 EXCEPTION.

build_http_error_response picks the code from the detail text, so rewording an error string can change the code the app sees.
Unhandled exceptions become 500 code 1006 inside RequestContextMiddleware. That response is built outside CORSMiddleware and skips the JWT-expired remap in main.py:250-254.
The remap that does run is in build_error_response: a 5xx built with error=exc becomes 401 when PostgREST reports an expired JWT.
Some routes raise HTTPException(500, detail=str(e)), as in gamification.py:62-64, so the raw error text reaches the app.

Every response carries X-Request-ID. Search the JSON logs for that request_id.
Logs go to stdout as JSON with request_id, parent_id, method and path (utils/structured_logging.py).
New Relic wraps uvicorn only when [redacted] is set (docker-entrypoint.sh).